Chapter 2 of 8 · EC-Council 312-39

Understanding Cyber Threats, IoCs, and Attack Methodology

Threat actors, network, host, application, email and insider TTPs, IoCs, kill chain and ATT&CK.

  • 4topics
  • 20 minfast track
  • 2diagrams and exhibits
  • 8%of the exam
Start with Cyber Threats and Network Attack TTPs

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1Cyber Threats and Network Attack TTPsLearn cyber threat actors, motives and business impact, and recognize network attack TTPs such as scanning, spoofing, DoS and DNS…5 min
  2. 2Host and Application Attack TTPsRecognize host attack TTPs such as malware, privilege escalation and persistence, and web application attacks like SQL injection…5 min
  3. 3Social Engineering, Email and Insider Attack TTPsRecognize social engineering, phishing, email spoofing, BEC and insider threat TTPs, with the signs each leaves for SOC analysts…5 min
  4. 4Indicators of Compromise and Attack FrameworksLearn IoC categories, IoCs versus IoAs, the Pyramid of Pain, the Cyber Kill Chain, MITRE ATT&CK tactics and the Diamond Model for…Diagram5 min

About this chapter

What this chapter covers

Understanding Cyber Threats, IoCs, and Attack Methodology is 8% of the EC-Council CSA 312-39 exam. It covers cyber threats and their impact, the tactics, techniques and procedures (TTPs) of network, host, application, social engineering, email and insider attacks, the indicators of compromise (IoCs) each attack leaves, and the frameworks that describe attack methodology, such as the Cyber Kill Chain and MITRE ATT&CK.

Questions are single-answer multiple choice, often "Which of the following" and short named scenarios. You are asked to name the attack from what it leaves in logs and alerts, to classify an IoC, or to place an action in the right kill chain stage or ATT&CK tactic.

It has 9 outline topics, and four pages cover them.

How the topics fit together

The chapter describes the attacker first, then what each attack looks like, then how analysts organize that knowledge.

Threat actorsmotive and impactTTPsnetwork, host, applicationTTPspeople, email, insidersIoCswhat the SOC seesFrameworkskill chain, ATT&CK

The TTP pages teach you to recognize each attack. The last page turns those signs into indicators and maps them to a framework, which is how a SOC analyst reports them.

Exam tip

For every attack, learn the trace it leaves. The exam rarely asks how to perform an attack, but it often describes a log entry or alert and asks which attack it shows.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

  • What it is: the idea in plain words.
  • How it works: the mechanism, with tables and examples.
  • What to remember for the exam: the facts to memorize.
  • Common mistakes: the classic traps.
  • Check yourself: three questions to test your understanding.

Try to name the next step for each short scenario before reading the answer. The exam often asks what to do first, or which tool fits.

Ready for more practice?

The full EC-Council 312-39 question bank has 700 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.